├── KernelDriver
    ├── README.md
    ├── hook.h
    ├── KernelDriver.vcxproj.user
    ├── main.cpp
    ├── memory.h
    ├── KernelDriver.vcxproj.filters
    ├── KernelDriver.inf
    ├── hook.cpp
    ├── definitions.h
    ├── memory.cpp
    └── KernelDriver.vcxproj
├── UMCheat
    ├── UMCheat.vcxproj.user
    ├── offsets.hpp
    ├── offsets.cpp
    ├── UMCheat.vcxproj.filters
    ├── UMCheat.vcxproj
    └── main.cpp
├── README.md
└── ApexTool.sln


/KernelDriver/README.md:
--------------------------------------------------------------------------------
1 | credits: null
2 | uwu


--------------------------------------------------------------------------------
/UMCheat/UMCheat.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/KernelDriver/hook.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "memory.h"
3 | 
4 | namespace nullhook
5 | {
6 | 	bool call_kernel_function(void* kernel_function_address);
7 | 	NTSTATUS hook_handler(PVOID called_param);
8 | }


--------------------------------------------------------------------------------
/KernelDriver/KernelDriver.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
4 |     <SignMode>Off</SignMode>
5 |   </PropertyGroup>
6 | </Project>


--------------------------------------------------------------------------------
/KernelDriver/main.cpp:
--------------------------------------------------------------------------------
 1 | #include "hook.h"
 2 | 
 3 | extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT driver_object, PUNICODE_STRING reg_path)
 4 | {
 5 | 	UNREFERENCED_PARAMETER(driver_object);
 6 | 	UNREFERENCED_PARAMETER(reg_path);
 7 | 
 8 | 	nullhook::call_kernel_function(&nullhook::hook_handler);
 9 | 
10 | 	return STATUS_SUCCESS;
11 | }


--------------------------------------------------------------------------------
/UMCheat/offsets.hpp:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | class OFFSETS
 4 | {
 5 | 
 6 | public:
 7 | 	OFFSETS();
 8 | 	static int OFFSET_MATRIX;
 9 | 	static int OFFSET_RENDER;
10 | 	static int OFFSET_ENTITYLIST;
11 | 	static int OFFSET_ORIGIN;
12 | 
13 | 	static int OFFSET_LOCAL_ENT;
14 | 
15 | 	static int OFFSET_TEAM;
16 | 	static int OFFSET_HEALTH;
17 | 	static int OFFSET_SHEILD;
18 | 
19 | 	static int OFFSET_LIFE_STATE;
20 | 	static int OFFSET_BLEED_OUT_STATE;
21 | 	static int OFFSET_VISIBLE_TIME;
22 | 
23 | 	static int GLOW_CONTEXT;
24 | 	static int GLOW_VISIBLE_TYPE;
25 | 	static int GLOW_TYPE;
26 | 	static int GLOW_COLOR;
27 | };


--------------------------------------------------------------------------------
/KernelDriver/memory.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | #include "definitions.h"
 3 | 
 4 | PVOID get_system_module_base(const char* module_name);
 5 | PVOID get_system_module_export(const char* module_name, LPCSTR routine_name);
 6 | bool write_memory(void* address, void* buffer, size_t size);
 7 | bool write_to_read_only_memory(void* address, void* buffer, size_t size);
 8 | ULONG64 get_module_base_x64(PEPROCESS proc, UNICODE_STRING module_name);
 9 | bool read_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size);
10 | bool write_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size);
11 | 
12 | typedef struct _NULL_MEMORY
13 | {
14 | 	void* buffer_address;
15 | 	UINT_PTR address;
16 | 	ULONGLONG size;
17 | 	ULONG pid;
18 | 	BOOLEAN write;
19 | 	BOOLEAN read;
20 | 	BOOLEAN req_base;
21 | 	void* output;
22 | 	const char* module_name;
23 | 	ULONG64 base_address;
24 | }NULL_MEMORY;


--------------------------------------------------------------------------------
/UMCheat/offsets.cpp:
--------------------------------------------------------------------------------
 1 | #include "offsets.hpp"
 2 | 
 3 | OFFSETS::OFFSETS() {};
 4 | 
 5 | // BOX
 6 | int OFFSETS::OFFSET_MATRIX = 0x001B3BD0; // ViewMatrix
 7 | int OFFSETS::OFFSET_RENDER = 0x408B768; // ViewRender
 8 | int OFFSETS::OFFSET_ENTITYLIST = 0x18DA3F8; // cl_entitylist
 9 | int OFFSETS::OFFSET_ORIGIN = 0x14C; // m_vecAbsOrigin
10 | 
11 | 
12 | // ENTITY
13 | int OFFSETS::OFFSET_LOCAL_ENT = 0x1C898F8; // LocalPlayer
14 | 
15 | int OFFSETS::OFFSET_TEAM = 0x0450; // m_iTeamNum
16 | int OFFSETS::OFFSET_HEALTH = 0x0440; // m_iHealth
17 | int OFFSETS::OFFSET_SHEILD = 0x0170; // m_shieldHealth
18 | 
19 | int OFFSETS::OFFSET_LIFE_STATE = 0x0798; // m_lifeState
20 | int OFFSETS::OFFSET_BLEED_OUT_STATE = 0x25E8; // m_bleedoutState
21 | int OFFSETS::OFFSET_VISIBLE_TIME = 0x1A4C; // m_visibletime
22 | 
23 | 
24 | // GLOW
25 | int OFFSETS::GLOW_CONTEXT = 0x3C8; // Script_Highlight_SetCurrentContext
26 | int OFFSETS::GLOW_VISIBLE_TYPE = 0x3D0; // Script_Highlight_SetVisibilityType - 5th mov
27 | int OFFSETS::GLOW_TYPE = 0x2C4; // Script_Highlight_GetState + 4
28 | int OFFSETS::GLOW_COLOR = 0x1D0; // Script_CopyHighlightState 15th mov
29 | 


--------------------------------------------------------------------------------
/UMCheat/UMCheat.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="main.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 |   <ItemGroup>
23 |     <ClInclude Include="offsets.cpp">
24 |       <Filter>Source Files</Filter>
25 |     </ClInclude>
26 |     <ClInclude Include="offsets.hpp">
27 |       <Filter>Source Files</Filter>
28 |     </ClInclude>
29 |   </ItemGroup>
30 | </Project>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # External Apex Tool
 2 | [![Discord](https://img.shields.io/discord/748288505507217428.svg?label=&logo=discord&logoColor=ffffff&color=7389D8&labelColor=6A7EC2)](https://discord.gg/AEfuvwT)
 3 |   
 4 | ## Infos:
 5 | Driver is detected and 2 cheat games will result in your account being banned!  
 6 |   
 7 | Glow is based on:
 8 |   - [NUM1] > Life + Shield 
 9 |     - light pink: 1-50,
10 | 	- pink: 50-100,
11 | 	- purple: 80-120,
12 | 	- dark purple: 120-150,
13 | 	- blue: 150-180,
14 | 	- dark blue: 180-200
15 |   - [NUM2] > Vision 
16 |     - darker: can't see enemy,
17 | 	- lighter: can see enemy
18 |   
19 | ## How to:
20 | - Use VS 2019  
21 | - Install WDK & SDK  
22 |   - Make sure that /Qspectre is disabled for driver  
23 |   - Build driver and cheat as `Release x64`  
24 | - Map driver using KDMapper (https://github.com/TheCruZ/kdmapper)  
25 | - Launch game  
26 | - Launch UM in menu
27 |   
28 | ## Credits:
29 | - Null (driver)  
30 | - AdrianVPL (glow)
31 |   
32 | ## Keybinds:
33 | If you want to change keybinds use:  
34 | https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes  
35 | find interesting key `VK_` or `0x` code and put inside `main.cpp` (CheatUM) at correct place, eg.:  
36 | `if (GetAsyncKeyState(VK_NUMPAD1))` -> `if (GetAsyncKeyState(VK_NUMPAD5))` or sth  
37 |   
38 | ## Hooked function:
39 | If you want to change function which is being hooked by driver find:
40 | `NtOpenCompositionSurfaceSectionInfo`  
41 | inside `main.cpp` (CheatUM) & `hook.cpp` (Driver)  
42 | and then change it for something else (https://github.com/hfiref0x/NtCall64/blob/master/Source/NtCall64/tables.h)  
43 |   
44 | Remember! There can't be `__security_cookie` inside, coz its going to cause bsod ;x
45 | 
46 | ## Images:
47 | ![img](https://i.imgur.com/cjggaZF.png)  
48 |   
49 |   
50 | glhf
51 | 


--------------------------------------------------------------------------------
/KernelDriver/KernelDriver.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |     <Filter Include="Driver Files">
17 |       <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
18 |       <Extensions>inf;inv;inx;mof;mc;</Extensions>
19 |     </Filter>
20 |   </ItemGroup>
21 |   <ItemGroup>
22 |     <Inf Include="KernelDriver.inf">
23 |       <Filter>Driver Files</Filter>
24 |     </Inf>
25 |   </ItemGroup>
26 |   <ItemGroup>
27 |     <ClInclude Include="definitions.h">
28 |       <Filter>Header Files</Filter>
29 |     </ClInclude>
30 |     <ClInclude Include="memory.h">
31 |       <Filter>Header Files</Filter>
32 |     </ClInclude>
33 |     <ClInclude Include="hook.h">
34 |       <Filter>Header Files</Filter>
35 |     </ClInclude>
36 |   </ItemGroup>
37 |   <ItemGroup>
38 |     <ClCompile Include="memory.cpp">
39 |       <Filter>Source Files</Filter>
40 |     </ClCompile>
41 |     <ClCompile Include="hook.cpp">
42 |       <Filter>Source Files</Filter>
43 |     </ClCompile>
44 |     <ClCompile Include="main.cpp">
45 |       <Filter>Source Files</Filter>
46 |     </ClCompile>
47 |   </ItemGroup>
48 | </Project>


--------------------------------------------------------------------------------
/KernelDriver/KernelDriver.inf:
--------------------------------------------------------------------------------
 1 | ;
 2 | ; KernelDriver.inf
 3 | ;
 4 | 
 5 | [Version]
 6 | Signature="$WINDOWS NT$"
 7 | Class=Sample ; TODO: edit Class
 8 | ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
 9 | Provider=%ManufacturerName%
10 | CatalogFile=KernelDriver.cat
11 | DriverVer= ; TODO: set DriverVer in stampinf property pages
12 | 
13 | [DestinationDirs]
14 | DefaultDestDir = 12
15 | KernelDriver_Device_CoInstaller_CopyFiles = 11
16 | 
17 | ; ================= Class section =====================
18 | 
19 | [ClassInstall32]
20 | Addreg=SampleClassReg
21 | 
22 | [SampleClassReg]
23 | HKR,,,0,%ClassName%
24 | HKR,,Icon,,-5
25 | 
26 | [SourceDisksNames]
27 | 1 = %DiskName%,,,""
28 | 
29 | [SourceDisksFiles]
30 | KernelDriver.sys  = 1,,
31 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
32 | 
33 | ;*****************************************
34 | ; Install Section
35 | ;*****************************************
36 | 
37 | [Manufacturer]
38 | %ManufacturerName%=Standard,NT$ARCH$
39 | 
40 | [Standard.NT$ARCH$]
41 | %KernelDriver.DeviceDesc%=KernelDriver_Device, Root\KernelDriver ; TODO: edit hw-id
42 | 
43 | [KernelDriver_Device.NT]
44 | CopyFiles=Drivers_Dir
45 | 
46 | [Drivers_Dir]
47 | KernelDriver.sys
48 | 
49 | ;-------------- Service installation
50 | [KernelDriver_Device.NT.Services]
51 | AddService = KernelDriver,%SPSVCINST_ASSOCSERVICE%, KernelDriver_Service_Inst
52 | 
53 | ; -------------- KernelDriver driver install sections
54 | [KernelDriver_Service_Inst]
55 | DisplayName    = %KernelDriver.SVCDESC%
56 | ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
57 | StartType      = 3               ; SERVICE_DEMAND_START
58 | ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
59 | ServiceBinary  = %12%\KernelDriver.sys
60 | 
61 | ;
62 | ;--- KernelDriver_Device Coinstaller installation ------
63 | ;
64 | 
65 | [KernelDriver_Device.NT.CoInstallers]
66 | AddReg=KernelDriver_Device_CoInstaller_AddReg
67 | CopyFiles=KernelDriver_Device_CoInstaller_CopyFiles
68 | 
69 | [KernelDriver_Device_CoInstaller_AddReg]
70 | HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
71 | 
72 | [KernelDriver_Device_CoInstaller_CopyFiles]
73 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
74 | 
75 | [KernelDriver_Device.NT.Wdf]
76 | KmdfService =  KernelDriver, KernelDriver_wdfsect
77 | [KernelDriver_wdfsect]
78 | KmdfLibraryVersion = $KMDFVERSION$
79 | 
80 | [Strings]
81 | SPSVCINST_ASSOCSERVICE= 0x00000002
82 | ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
83 | ClassName="Samples" ; TODO: edit ClassName
84 | DiskName = "KernelDriver Installation Disk"
85 | KernelDriver.DeviceDesc = "KernelDriver Device"
86 | KernelDriver.SVCDESC = "KernelDriver Service"
87 | 


--------------------------------------------------------------------------------
/KernelDriver/hook.cpp:
--------------------------------------------------------------------------------
 1 | #include "hook.h"
 2 | 
 3 | bool nullhook::call_kernel_function(void* kernel_function_address)
 4 | {
 5 | 	if (!kernel_function_address)
 6 | 		return false;
 7 | 
 8 | 	PVOID* function = reinterpret_cast<PVOID*>(get_system_module_export("\\SystemRoot\\System32\\drivers\\dxgkrnl.sys",
 9 | 		"NtOpenCompositionSurfaceSectionInfo")); // NtOpenCompositionSurfaceSectionInfo
10 | 
11 | 	if (!function)
12 | 		return false;
13 | 
14 | 	BYTE orig[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };	//0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
15 | 
16 | 	BYTE shell_code[] = { 0x48, 0xB8 }; // mov rax, xxx // 0x48 - 0xB8
17 | 	BYTE shell_code_end[] = { 0xFF, 0xE0 }; //jmp rax   // 0xFF - 0xE0
18 | 
19 | 	RtlSecureZeroMemory(&orig, sizeof(orig));
20 | 	memcpy((PVOID)((ULONG_PTR)orig), &shell_code, sizeof(shell_code));
21 | 	uintptr_t hook_address = reinterpret_cast<uintptr_t>(kernel_function_address);
22 | 	memcpy((PVOID)((ULONG_PTR)orig + sizeof(shell_code)), &hook_address, sizeof(void*));
23 | 	memcpy((PVOID)((ULONG_PTR)orig + sizeof(shell_code) + sizeof(void*)), &shell_code_end, sizeof(shell_code_end));
24 | 
25 | 	write_to_read_only_memory(function, &orig, sizeof(orig));
26 | 
27 | 	return true;
28 | }
29 | 
30 | NTSTATUS nullhook::hook_handler(PVOID called_param)
31 | {
32 | 	NULL_MEMORY* instructions = (NULL_MEMORY*)called_param;
33 | 
34 | 	if (instructions->req_base != FALSE)
35 | 	{
36 | 		ANSI_STRING AS;
37 | 		UNICODE_STRING ModuleName;
38 | 
39 | 		RtlInitAnsiString(&AS, instructions->module_name);
40 | 		RtlAnsiStringToUnicodeString(&ModuleName, &AS, TRUE);
41 | 
42 | 		PEPROCESS process;
43 | 		ULONG64 base_address64 = NULL;
44 | 		if ((HANDLE)instructions->pid != 0) {
45 | 			PsLookupProcessByProcessId((HANDLE)instructions->pid, &process);
46 | 			base_address64 = get_module_base_x64(process, ModuleName);
47 | 		}
48 | 		instructions->base_address = base_address64;
49 | 		RtlFreeUnicodeString(&ModuleName);
50 | 	}
51 | 
52 | 	if (instructions->write != FALSE)
53 | 	{
54 | 		if (instructions->address < 0x7FFFFFFFFFFF && instructions->address > 0)
55 | 		{
56 | 			PVOID kernelBuff = ExAllocatePool(NonPagedPool, instructions->size);
57 | 
58 | 			if (!kernelBuff)
59 | 			{
60 | 				return STATUS_UNSUCCESSFUL;
61 | 			}
62 | 
63 | 			if (!memcpy(kernelBuff, instructions->buffer_address, instructions->size))
64 | 			{
65 | 				return STATUS_UNSUCCESSFUL;
66 | 			}
67 | 
68 | 			PEPROCESS process;
69 | 			if ((HANDLE)instructions->pid != 0) {
70 | 				PsLookupProcessByProcessId((HANDLE)instructions->pid, &process);
71 | 				write_kernel_memory((HANDLE)instructions->pid, instructions->address, kernelBuff, instructions->size);
72 | 			}
73 | 			ExFreePool(kernelBuff);
74 | 		}
75 | 	}
76 | 
77 | 	if (instructions->read != FALSE)
78 | 	{
79 | 		if (instructions->address < 0x7FFFFFFFFFFF && instructions->address > 0)
80 | 		{
81 | 			read_kernel_memory((HANDLE)instructions->pid, instructions->address, instructions->output, instructions->size);
82 | 		}
83 | 	}
84 | 
85 | 	return STATUS_SUCCESS;
86 | }


--------------------------------------------------------------------------------
/ApexTool.sln:
--------------------------------------------------------------------------------
 1 | Microsoft Visual Studio Solution File, Format Version 12.00
 2 | # Visual Studio Version 19
 3 | VisualStudioVersion = 16.9.31129.286
 4 | MinimumVisualStudioVersion = 16.0.29905.134
 5 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Driver", "KernelDriver\KernelDriver.vcxproj", "{59AD331E-D3D4-46C4-8759-4A02AB42353A}"
 6 | EndProject
 7 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Usermode", "UMCheat\UMCheat.vcxproj", "{64DE4F42-B12F-431D-89D5-89F8C41249B5}"
 8 | EndProject
 9 | Global
10 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
11 | 		Debug|ARM = Debug|ARM
12 | 		Debug|ARM64 = Debug|ARM64
13 | 		Debug|x64 = Debug|x64
14 | 		Debug|x86 = Debug|x86
15 | 		Release|ARM = Release|ARM
16 | 		Release|ARM64 = Release|ARM64
17 | 		Release|x64 = Release|x64
18 | 		Release|x86 = Release|x86
19 | 	EndGlobalSection
20 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
21 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM.ActiveCfg = Debug|ARM
22 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM.Build.0 = Debug|ARM
23 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM.Deploy.0 = Debug|ARM
24 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM64.ActiveCfg = Debug|ARM64
25 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM64.Build.0 = Debug|ARM64
26 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM64.Deploy.0 = Debug|ARM64
27 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x64.ActiveCfg = Debug|x64
28 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x64.Build.0 = Debug|x64
29 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x64.Deploy.0 = Debug|x64
30 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x86.ActiveCfg = Debug|Win32
31 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x86.Build.0 = Debug|Win32
32 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x86.Deploy.0 = Debug|Win32
33 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM.ActiveCfg = Release|ARM
34 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM.Build.0 = Release|ARM
35 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM.Deploy.0 = Release|ARM
36 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM64.ActiveCfg = Release|ARM64
37 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM64.Build.0 = Release|ARM64
38 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM64.Deploy.0 = Release|ARM64
39 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x64.ActiveCfg = Release|x64
40 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x64.Build.0 = Release|x64
41 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x64.Deploy.0 = Release|x64
42 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x86.ActiveCfg = Release|Win32
43 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x86.Build.0 = Release|Win32
44 | 		{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x86.Deploy.0 = Release|Win32
45 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|ARM.ActiveCfg = Debug|Win32
46 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|ARM64.ActiveCfg = Debug|Win32
47 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|x64.ActiveCfg = Debug|x64
48 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|x64.Build.0 = Debug|x64
49 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|x86.ActiveCfg = Debug|Win32
50 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Debug|x86.Build.0 = Debug|Win32
51 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|ARM.ActiveCfg = Release|Win32
52 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|ARM64.ActiveCfg = Release|Win32
53 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|x64.ActiveCfg = Release|x64
54 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|x64.Build.0 = Release|x64
55 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|x86.ActiveCfg = Release|Win32
56 | 		{64DE4F42-B12F-431D-89D5-89F8C41249B5}.Release|x86.Build.0 = Release|Win32
57 | 	EndGlobalSection
58 | 	GlobalSection(SolutionProperties) = preSolution
59 | 		HideSolutionNode = FALSE
60 | 	EndGlobalSection
61 | 	GlobalSection(ExtensibilityGlobals) = postSolution
62 | 		SolutionGuid = {689D2A6E-68F2-42AE-8B13-36F3041DB588}
63 | 	EndGlobalSection
64 | EndGlobal
65 | 


--------------------------------------------------------------------------------
/KernelDriver/definitions.h:
--------------------------------------------------------------------------------
  1 | #include <ntdef.h>
  2 | #include <ntifs.h>
  3 | #include <ntddk.h>
  4 | #include <windef.h>
  5 | #include <ntstrsafe.h>
  6 | #include <wdm.h>
  7 | #pragma comment(lib, "ntoskrnl.lib")
  8 | 
  9 | typedef enum _SYSTEM_INFORMATION_CLASS
 10 | {
 11 | 	SystemBasicInformation,
 12 | 	SystemProcessorInformation,
 13 | 	SystemPerformanceInformation,
 14 | 	SystemTimeOfDayInformation,
 15 | 	SystemPathInformation,
 16 | 	SystemProcessInformation,
 17 | 	SystemCallCountInformation,
 18 | 	SystemDeviceInformation,
 19 | 	SystemProcessorPerformanceInformation,
 20 | 	SystemFlagsInformation,
 21 | 	SystemCallTimeInformation,
 22 | 	SystemModuleInformation = 0x0B
 23 | } SYSTEM_INFORMATION_CLASS,
 24 | * PSYSTEM_INFORMATION_CLASS;
 25 | 
 26 | typedef struct _RTL_PROCESS_MODULE_INFORMATION
 27 | {
 28 | 	HANDLE Section;
 29 | 	PVOID MappedBase;
 30 | 	PVOID ImageBase;
 31 | 	ULONG ImageSize;
 32 | 	ULONG Flags;
 33 | 	USHORT LoadOrderIndex;
 34 | 	USHORT InitOrderIndex;
 35 | 	USHORT LoadCount;
 36 | 	USHORT OffsetToFileName;
 37 | 	UCHAR  FullPathName[256];
 38 | } RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
 39 | 
 40 | typedef struct _RTL_PROCESS_MODULES
 41 | {
 42 | 	ULONG NumberOfModules;
 43 | 	RTL_PROCESS_MODULE_INFORMATION Modules[1];
 44 | } RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
 45 | 
 46 | typedef struct _PEB_LDR_DATA {
 47 | 	ULONG Length;
 48 | 	BOOLEAN Initialized;
 49 | 	PVOID SsHandle;
 50 | 	LIST_ENTRY ModuleListLoadOrder;
 51 | 	LIST_ENTRY ModuleListMemoryOrder;
 52 | 	LIST_ENTRY ModuleListInitOrder;
 53 | } PEB_LDR_DATA, * PPEB_LDR_DATA;
 54 | 
 55 | typedef struct _LDR_DATA_TABLE_ENTRY {
 56 | 	LIST_ENTRY InLoadOrderModuleList;
 57 | 	LIST_ENTRY InMemoryOrderModuleList;
 58 | 	LIST_ENTRY InInitializationOrderModuleList;
 59 | 	PVOID DllBase;
 60 | 	PVOID EntryPoint;
 61 | 	ULONG SizeOfImage;  // in bytes
 62 | 	UNICODE_STRING FullDllName;
 63 | 	UNICODE_STRING BaseDllName;
 64 | 	ULONG Flags;  // LDR_*
 65 | 	USHORT LoadCount;
 66 | 	USHORT TlsIndex;
 67 | 	LIST_ENTRY HashLinks;
 68 | 	PVOID SectionPointer;
 69 | 	ULONG CheckSum;
 70 | 	ULONG TimeDateStamp;
 71 | } LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
 72 | 
 73 | typedef struct _RTL_USER_PROCESS_PARAMETERS {
 74 | 	BYTE Reserved1[16];
 75 | 	PVOID Reserved2[10];
 76 | 	UNICODE_STRING ImagePathName;
 77 | 	UNICODE_STRING CommandLine;
 78 | } RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
 79 | 
 80 | typedef void(__stdcall* PPS_POST_PROCESS_INIT_ROUTINE)(void); // not exported
 81 | 
 82 | typedef struct _PEB {
 83 | 	BYTE Reserved1[2];
 84 | 	BYTE BeingDebugged;
 85 | 	BYTE Reserved2[1];
 86 | 	PVOID Reserved3[2];
 87 | 	PPEB_LDR_DATA Ldr;
 88 | 	PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 89 | 	PVOID Reserved4[3];
 90 | 	PVOID AtlThunkSListPtr;
 91 | 	PVOID Reserved5;
 92 | 	ULONG Reserved6;
 93 | 	PVOID Reserved7;
 94 | 	ULONG Reserved8;
 95 | 	ULONG AtlThunkSListPtr32;
 96 | 	PVOID Reserved9[45];
 97 | 	BYTE Reserved10[96];
 98 | 	PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
 99 | 	BYTE Reserved11[128];
100 | 	PVOID Reserved12[1];
101 | 	ULONG SessionId;
102 | } PEB, * PPEB;
103 | 
104 | extern "C" __declspec(dllimport)
105 | NTSTATUS NTAPI ZwProtectVirtualMemory(
106 | 	HANDLE ProcessHandle,
107 | 	PVOID * BaseAddress,
108 | 	PULONG ProtectSize,
109 | 	ULONG NewProtect,
110 | 	PULONG OldProtect
111 | );
112 | 
113 | extern "C" NTKERNELAPI
114 | PVOID
115 | NTAPI
116 | RtlFindExportedRoutineByName(
117 | 	_In_ PVOID ImageBase,
118 | 	_In_ PCCH RoutineNam
119 | );
120 | 
121 | extern "C" NTSTATUS ZwQuerySystemInformation(ULONG InfoClass, PVOID Buffer, ULONG Length, PULONG ReturnLength);
122 | 
123 | extern "C" NTKERNELAPI
124 | PPEB
125 | PsGetProcessPeb(
126 | 	IN PEPROCESS Process
127 | );
128 | 
129 | extern "C" NTSTATUS NTAPI MmCopyVirtualMemory
130 | (
131 | 	PEPROCESS SourceProcess,
132 | 	PVOID SourceAddress,
133 | 	PEPROCESS TargetProcess,
134 | 	PVOID TargetAddress,
135 | 	SIZE_T BufferSize,
136 | 	KPROCESSOR_MODE PreviousMode,
137 | 	PSIZE_T ReturnSize
138 | );


--------------------------------------------------------------------------------
/KernelDriver/memory.cpp:
--------------------------------------------------------------------------------
  1 | #include "memory.h"
  2 | 
  3 | PVOID get_system_module_base(const char* module_name)
  4 | {
  5 | 	ULONG bytes = 0;
  6 | 	NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, NULL, bytes, &bytes);
  7 | 
  8 | 	if (!bytes)
  9 | 		return NULL;
 10 | 
 11 | 	PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x4e554c4c);
 12 | 
 13 | 	status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes);
 14 | 
 15 | 	if (!NT_SUCCESS(status))
 16 | 		return NULL;
 17 | 
 18 | 
 19 | 
 20 | 	PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
 21 | 	PVOID module_base = 0, module_size = 0;
 22 | 
 23 | 	for (ULONG i = 0; i < modules->NumberOfModules; i++)
 24 | 	{
 25 | 		if (strcmp((char*)module[i].FullPathName, module_name) == NULL)
 26 | 		{
 27 | 			module_base = module[i].ImageBase;
 28 | 			module_size = (PVOID)module[i].ImageSize;
 29 | 			break;
 30 | 		}
 31 | 	}
 32 | 
 33 | 	if (modules)
 34 | 		ExFreePoolWithTag(modules, NULL);
 35 | 
 36 | 	if (module_base <= NULL)
 37 | 		return NULL;
 38 | 
 39 | 	return module_base;
 40 | }
 41 | 
 42 | PVOID get_system_module_export(const char* module_name, LPCSTR routine_name)
 43 | {
 44 | 	PVOID lpModule = get_system_module_base(module_name);
 45 | 
 46 | 	if (!lpModule)
 47 | 		return NULL;
 48 | 
 49 | 	return RtlFindExportedRoutineByName(lpModule, routine_name);
 50 | }
 51 | 
 52 | bool write_memory(void* address, void* buffer, size_t size)
 53 | {
 54 | 	if (!RtlCopyMemory(address, buffer, size))
 55 | 	{
 56 | 		return false;
 57 | 	}
 58 | 	else
 59 | 	{
 60 | 		return true;
 61 | 	}
 62 | }
 63 | 
 64 | bool write_to_read_only_memory(void* address, void* buffer, size_t size)
 65 | {
 66 | 	PMDL Mdl = IoAllocateMdl(address, size, FALSE, FALSE, NULL);
 67 | 
 68 | 	if (!Mdl)
 69 | 		return false;
 70 | 
 71 | 	MmProbeAndLockPages(Mdl, KernelMode, IoReadAccess);
 72 | 	PVOID Mapping = MmMapLockedPagesSpecifyCache(Mdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority);
 73 | 	MmProtectMdlSystemAddress(Mdl, PAGE_READWRITE);
 74 | 
 75 | 	write_memory(Mapping, buffer, size);
 76 | 
 77 | 	MmUnmapLockedPages(Mapping, Mdl);
 78 | 	MmUnlockPages(Mdl);
 79 | 	IoFreeMdl(Mdl);
 80 | 
 81 | 	return true;
 82 | }
 83 | 
 84 | ULONG64 get_module_base_x64(PEPROCESS proc, UNICODE_STRING module_name)
 85 | {
 86 | 	PPEB pPeb = PsGetProcessPeb(proc);
 87 | 
 88 | 	if (!pPeb)
 89 | 	{
 90 | 		return NULL;
 91 | 	}
 92 | 
 93 | 	KAPC_STATE state;
 94 | 
 95 | 	KeStackAttachProcess(proc, &state);
 96 | 
 97 | 	PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)pPeb->Ldr;
 98 | 
 99 | 	if (!pLdr)
100 | 	{
101 | 		KeUnstackDetachProcess(&state);
102 | 		return NULL;
103 | 	}
104 | 
105 | 	for (PLIST_ENTRY list = (PLIST_ENTRY)pLdr->ModuleListLoadOrder.Flink; list != &pLdr->ModuleListLoadOrder; list = (PLIST_ENTRY)list->Flink)
106 | 	{
107 | 		PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
108 | 
109 | 		if (RtlCompareUnicodeString(&pEntry->BaseDllName, &module_name, TRUE) == NULL)
110 | 		{
111 | 			ULONG64 baseAddr = (ULONG64)pEntry->DllBase;
112 | 			KeUnstackDetachProcess(&state);
113 | 			return baseAddr;
114 | 		}
115 | 	}
116 | 
117 | 	KeUnstackDetachProcess(&state);
118 | 	return NULL;
119 | }
120 | 
121 | bool read_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size)
122 | {
123 | 	if (!address || !buffer || !size)
124 | 		return false;
125 | 
126 | 	SIZE_T bytes = 0;
127 | 	NTSTATUS status = STATUS_SUCCESS;
128 | 	PEPROCESS process;
129 | 
130 | 	if ((HANDLE)pid == 0) return false;
131 | 	PsLookupProcessByProcessId((HANDLE)pid, &process);
132 | 	status = MmCopyVirtualMemory(process, (void*)address, (PEPROCESS)PsGetCurrentProcess(), (void*)buffer, size, KernelMode, &bytes);
133 | 
134 | 	if (!NT_SUCCESS(status))
135 | 	{
136 | 		return false;
137 | 	}
138 | 	else
139 | 	{
140 | 		return true;
141 | 	}
142 | }
143 | 
144 | bool write_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size)
145 | {
146 | 	if (!address || !buffer || !size)
147 | 		return false;
148 | 
149 | 	NTSTATUS status = STATUS_SUCCESS;
150 | 	PEPROCESS process;
151 | 	if ((HANDLE)pid == 0) return false;
152 | 	PsLookupProcessByProcessId((HANDLE)pid, &process);
153 | 	KAPC_STATE state;
154 | 	KeStackAttachProcess((PEPROCESS)process, &state);
155 | 
156 | 	MEMORY_BASIC_INFORMATION info;
157 | 
158 | 	status = ZwQueryVirtualMemory(ZwCurrentProcess(), (PVOID)address, MemoryBasicInformation, &info, sizeof(info), NULL);
159 | 	if (!NT_SUCCESS(status))
160 | 	{
161 | 		KeUnstackDetachProcess(&state);
162 | 		return false;
163 | 	}
164 | 
165 | 	if (((uintptr_t)info.BaseAddress + info.RegionSize) < (address + size))
166 | 	{
167 | 		KeUnstackDetachProcess(&state);
168 | 		return false;
169 | 	}
170 | 
171 | 	if (!(info.State & MEM_COMMIT) || (info.Protect & (PAGE_GUARD | PAGE_NOACCESS)))
172 | 	{
173 | 		KeUnstackDetachProcess(&state);
174 | 		return false;
175 | 	}
176 | 
177 | 	if ((info.Protect & PAGE_EXECUTE_READWRITE) || (info.Protect & PAGE_EXECUTE_WRITECOPY)
178 | 		|| (info.Protect & PAGE_READWRITE) || (info.Protect & PAGE_WRITECOPY))
179 | 	{
180 | 		RtlCopyMemory((void*)address, buffer, size);
181 | 	}
182 | 	KeUnstackDetachProcess(&state);
183 | 	return true;
184 | }


--------------------------------------------------------------------------------
/UMCheat/UMCheat.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <ProjectGuid>{64DE4F42-B12F-431D-89D5-89F8C41249B5}</ProjectGuid>
 24 |     <RootNamespace>UMCheat</RootNamespace>
 25 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 26 |     <ProjectName>Usermode</ProjectName>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>MultiByte</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 77 |     <LinkIncremental>true</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 80 |     <LinkIncremental>false</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <WarningLevel>Level3</WarningLevel>
 88 |       <SDLCheck>true</SDLCheck>
 89 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 90 |       <ConformanceMode>true</ConformanceMode>
 91 |       <LanguageStandard>stdcpp17</LanguageStandard>
 92 |     </ClCompile>
 93 |     <Link>
 94 |       <SubSystem>Console</SubSystem>
 95 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 96 |     </Link>
 97 |   </ItemDefinitionGroup>
 98 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 99 |     <ClCompile>
100 |       <WarningLevel>Level3</WarningLevel>
101 |       <SDLCheck>true</SDLCheck>
102 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
103 |       <ConformanceMode>true</ConformanceMode>
104 |     </ClCompile>
105 |     <Link>
106 |       <SubSystem>Console</SubSystem>
107 |       <GenerateDebugInformation>true</GenerateDebugInformation>
108 |     </Link>
109 |   </ItemDefinitionGroup>
110 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
111 |     <ClCompile>
112 |       <WarningLevel>Level3</WarningLevel>
113 |       <FunctionLevelLinking>true</FunctionLevelLinking>
114 |       <IntrinsicFunctions>true</IntrinsicFunctions>
115 |       <SDLCheck>true</SDLCheck>
116 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
117 |       <ConformanceMode>true</ConformanceMode>
118 |     </ClCompile>
119 |     <Link>
120 |       <SubSystem>Console</SubSystem>
121 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
122 |       <OptimizeReferences>true</OptimizeReferences>
123 |       <GenerateDebugInformation>true</GenerateDebugInformation>
124 |     </Link>
125 |   </ItemDefinitionGroup>
126 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
127 |     <ClCompile>
128 |       <WarningLevel>Level3</WarningLevel>
129 |       <FunctionLevelLinking>true</FunctionLevelLinking>
130 |       <IntrinsicFunctions>true</IntrinsicFunctions>
131 |       <SDLCheck>true</SDLCheck>
132 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133 |       <ConformanceMode>true</ConformanceMode>
134 |       <LanguageStandard>stdcpplatest</LanguageStandard>
135 |     </ClCompile>
136 |     <Link>
137 |       <SubSystem>Console</SubSystem>
138 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
139 |       <OptimizeReferences>true</OptimizeReferences>
140 |       <GenerateDebugInformation>true</GenerateDebugInformation>
141 |     </Link>
142 |   </ItemDefinitionGroup>
143 |   <ItemGroup>
144 |     <ClCompile Include="main.cpp" />
145 |   </ItemGroup>
146 |   <ItemGroup>
147 |     <ClInclude Include="offsets.cpp" />
148 |     <ClInclude Include="offsets.hpp" />
149 |   </ItemGroup>
150 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
151 |   <ImportGroup Label="ExtensionTargets">
152 |   </ImportGroup>
153 | </Project>


--------------------------------------------------------------------------------
/KernelDriver/KernelDriver.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |     <ProjectConfiguration Include="Debug|ARM">
 21 |       <Configuration>Debug</Configuration>
 22 |       <Platform>ARM</Platform>
 23 |     </ProjectConfiguration>
 24 |     <ProjectConfiguration Include="Release|ARM">
 25 |       <Configuration>Release</Configuration>
 26 |       <Platform>ARM</Platform>
 27 |     </ProjectConfiguration>
 28 |     <ProjectConfiguration Include="Debug|ARM64">
 29 |       <Configuration>Debug</Configuration>
 30 |       <Platform>ARM64</Platform>
 31 |     </ProjectConfiguration>
 32 |     <ProjectConfiguration Include="Release|ARM64">
 33 |       <Configuration>Release</Configuration>
 34 |       <Platform>ARM64</Platform>
 35 |     </ProjectConfiguration>
 36 |   </ItemGroup>
 37 |   <PropertyGroup Label="Globals">
 38 |     <ProjectGuid>{59AD331E-D3D4-46C4-8759-4A02AB42353A}</ProjectGuid>
 39 |     <TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
 40 |     <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
 41 |     <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
 42 |     <Configuration>Debug</Configuration>
 43 |     <Platform Condition="'$(Platform)' == ''">Win32</Platform>
 44 |     <RootNamespace>KernelDriver</RootNamespace>
 45 |     <ProjectName>Driver</ProjectName>
 46 |   </PropertyGroup>
 47 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 49 |     <TargetVersion>Windows10</TargetVersion>
 50 |     <UseDebugLibraries>true</UseDebugLibraries>
 51 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 52 |     <ConfigurationType>Driver</ConfigurationType>
 53 |     <DriverType>KMDF</DriverType>
 54 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 55 |   </PropertyGroup>
 56 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 57 |     <TargetVersion>Windows10</TargetVersion>
 58 |     <UseDebugLibraries>false</UseDebugLibraries>
 59 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 60 |     <ConfigurationType>Driver</ConfigurationType>
 61 |     <DriverType>KMDF</DriverType>
 62 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 63 |   </PropertyGroup>
 64 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 65 |     <TargetVersion>Windows10</TargetVersion>
 66 |     <UseDebugLibraries>true</UseDebugLibraries>
 67 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 68 |     <ConfigurationType>Driver</ConfigurationType>
 69 |     <DriverType>KMDF</DriverType>
 70 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 71 |   </PropertyGroup>
 72 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 73 |     <TargetVersion>Windows10</TargetVersion>
 74 |     <UseDebugLibraries>false</UseDebugLibraries>
 75 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 76 |     <ConfigurationType>Driver</ConfigurationType>
 77 |     <DriverType>KMDF</DriverType>
 78 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 79 |     <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
 80 |   </PropertyGroup>
 81 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
 82 |     <TargetVersion>Windows10</TargetVersion>
 83 |     <UseDebugLibraries>true</UseDebugLibraries>
 84 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 85 |     <ConfigurationType>Driver</ConfigurationType>
 86 |     <DriverType>KMDF</DriverType>
 87 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 88 |   </PropertyGroup>
 89 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
 90 |     <TargetVersion>Windows10</TargetVersion>
 91 |     <UseDebugLibraries>false</UseDebugLibraries>
 92 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
 93 |     <ConfigurationType>Driver</ConfigurationType>
 94 |     <DriverType>KMDF</DriverType>
 95 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
 96 |   </PropertyGroup>
 97 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
 98 |     <TargetVersion>Windows10</TargetVersion>
 99 |     <UseDebugLibraries>true</UseDebugLibraries>
100 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
101 |     <ConfigurationType>Driver</ConfigurationType>
102 |     <DriverType>KMDF</DriverType>
103 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
104 |   </PropertyGroup>
105 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
106 |     <TargetVersion>Windows10</TargetVersion>
107 |     <UseDebugLibraries>false</UseDebugLibraries>
108 |     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
109 |     <ConfigurationType>Driver</ConfigurationType>
110 |     <DriverType>KMDF</DriverType>
111 |     <DriverTargetPlatform>Universal</DriverTargetPlatform>
112 |   </PropertyGroup>
113 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
114 |   <ImportGroup Label="ExtensionSettings">
115 |   </ImportGroup>
116 |   <ImportGroup Label="PropertySheets">
117 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
118 |   </ImportGroup>
119 |   <PropertyGroup Label="UserMacros" />
120 |   <PropertyGroup />
121 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
122 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
123 |   </PropertyGroup>
124 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
125 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
126 |   </PropertyGroup>
127 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
128 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
129 |   </PropertyGroup>
130 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
131 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
132 |     <EnableInf2cat>false</EnableInf2cat>
133 |   </PropertyGroup>
134 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
135 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
136 |   </PropertyGroup>
137 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
138 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
139 |   </PropertyGroup>
140 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
141 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
142 |   </PropertyGroup>
143 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
144 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
145 |   </PropertyGroup>
146 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
147 |     <Link>
148 |       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
149 |     </Link>
150 |     <ClCompile>
151 |       <TreatWarningAsError>false</TreatWarningAsError>
152 |     </ClCompile>
153 |   </ItemDefinitionGroup>
154 |   <ItemGroup>
155 |     <Inf Include="KernelDriver.inf" />
156 |   </ItemGroup>
157 |   <ItemGroup>
158 |     <FilesToPackage Include="$(TargetPath)" />
159 |   </ItemGroup>
160 |   <ItemGroup>
161 |     <ClInclude Include="definitions.h" />
162 |     <ClInclude Include="hook.h" />
163 |     <ClInclude Include="memory.h" />
164 |   </ItemGroup>
165 |   <ItemGroup>
166 |     <ClCompile Include="hook.cpp" />
167 |     <ClCompile Include="main.cpp" />
168 |     <ClCompile Include="memory.cpp" />
169 |   </ItemGroup>
170 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
171 |   <ImportGroup Label="ExtensionTargets">
172 |   </ImportGroup>
173 | </Project>


--------------------------------------------------------------------------------
/UMCheat/main.cpp:
--------------------------------------------------------------------------------
  1 | #include <iostream>
  2 | #include <Windows.h>
  3 | #include <TlHelp32.h>
  4 | #include <memory>
  5 | #include <string_view>
  6 | #include <cstdint>
  7 | #include <vector>
  8 | #include <string>
  9 | #include <ctime>
 10 | #include <random>
 11 | #include <stdlib.h>
 12 | #include "offsets.cpp"
 13 | #include <thread>
 14 | 
 15 | using namespace std;
 16 | 
 17 | namespace APEXTool {
 18 | 	namespace Controls
 19 | 	{
 20 | 		bool colors_based_on_life_and_shield = true;
 21 | 		bool colors_based_on_vision = false;
 22 | 	};
 23 | }
 24 | 
 25 | LPCTSTR WinName = "Apex Legends";
 26 | HWND hWnd = FindWindow(NULL, WinName);
 27 | 
 28 | uintptr_t pID;
 29 | uintptr_t moduleBase;
 30 | uintptr_t localPlayer;
 31 | uintptr_t entList;
 32 | uintptr_t viewRenderer;
 33 | uintptr_t viewMatrix;
 34 | 
 35 | typedef struct _NULL_MEMORY
 36 | {
 37 | 	void* buffer_address;
 38 | 	UINT_PTR address;
 39 | 	ULONGLONG size;
 40 | 	ULONG pid;
 41 | 	BOOLEAN write;
 42 | 	BOOLEAN read;
 43 | 	BOOLEAN req_base;
 44 | 	void* output;
 45 | 	const char* module_name;
 46 | 	ULONG64 base_address;
 47 | }NULL_MEMORY;
 48 | 
 49 | uintptr_t base_address = 0;
 50 | uint32_t process_id = 0;
 51 | 
 52 | template<typename ... Arg>
 53 | uint64_t call_hook(const Arg ... args)
 54 | {
 55 | 	void* hooked_func = GetProcAddress(LoadLibrary("win32u.dll"), "NtOpenCompositionSurfaceSectionInfo"); // NtOpenCompositionSurfaceSectionInfo
 56 | 
 57 | 	auto func = static_cast<uint64_t(_stdcall*)(Arg...)>(hooked_func);
 58 | 
 59 | 	return func(args ...);
 60 | }
 61 | 
 62 | struct HandleDisposer
 63 | {
 64 | 	using pointer = HANDLE;
 65 | 	void operator()(HANDLE handle) const
 66 | 	{
 67 | 		if (handle != NULL || handle != INVALID_HANDLE_VALUE)
 68 | 		{
 69 | 			CloseHandle(handle);
 70 | 		}
 71 | 	}
 72 | };
 73 | 
 74 | using unique_handle = unique_ptr<HANDLE, HandleDisposer>;
 75 | struct GlowMode
 76 | {
 77 | 	int8_t GeneralGlowMode, BorderGlowMode, BorderSize, TransparentLevel;
 78 | };
 79 | 
 80 | uint32_t get_process_id(string_view process_name)
 81 | {
 82 | 	PROCESSENTRY32 processentry;
 83 | 	const unique_handle snapshot_handle(CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL));
 84 | 
 85 | 	if (snapshot_handle.get() == INVALID_HANDLE_VALUE)
 86 | 		return NULL;
 87 | 
 88 | 	processentry.dwSize = sizeof(MODULEENTRY32);
 89 | 
 90 | 	while (Process32Next(snapshot_handle.get(), &processentry) == TRUE)
 91 | 	{
 92 | 		if (process_name.compare(processentry.szExeFile) == NULL)
 93 | 		{
 94 | 			return processentry.th32ProcessID;
 95 | 		}
 96 | 	}
 97 | 	return NULL;
 98 | }
 99 | 
100 | static ULONG64 get_module_base_address(const char* module_name)
101 | {
102 | 	NULL_MEMORY instructions = { 0 };
103 | 	instructions.pid = process_id;
104 | 	instructions.req_base = TRUE;
105 | 	instructions.read = FALSE;
106 | 	instructions.write = FALSE;
107 | 	instructions.module_name = module_name;
108 | 	call_hook(&instructions);
109 | 	
110 | 	ULONG64 base = NULL;
111 | 	base = instructions.base_address;
112 | 	return base;
113 | }
114 | template <class T>
115 | T Read(uintptr_t read_address)
116 | {
117 | 	T response{};
118 | 	NULL_MEMORY instructions;
119 | 	instructions.pid = process_id;
120 | 	instructions.size = sizeof(T);
121 | 	instructions.address = read_address;
122 | 	instructions.read = TRUE;
123 | 	instructions.write = FALSE;
124 | 	instructions.req_base = FALSE;
125 | 	instructions.output = &response;
126 | 	call_hook(&instructions);
127 | 
128 | 	return response;
129 | }
130 | 
131 | bool write_memory(UINT_PTR write_address, UINT_PTR source_address, SIZE_T write_size)
132 | {
133 | 	NULL_MEMORY instructions;
134 | 	instructions.address = write_address;
135 | 	instructions.pid = process_id;
136 | 	instructions.write = TRUE;
137 | 	instructions.read = FALSE;
138 | 	instructions.req_base = FALSE;
139 | 	instructions.buffer_address = (void*)source_address;
140 | 	instructions.size = write_size;
141 | 
142 | 	call_hook(&instructions);
143 | 
144 | 	return true;
145 | }
146 | 
147 | template<typename S>
148 | bool write(UINT_PTR write_address, const S& value)
149 | {
150 | 	return write_memory(write_address, (UINT_PTR)&value, sizeof(S));
151 | }
152 | 
153 | 
154 | DWORD64 GetEntityByID(int Ent, DWORD64 Base)
155 | {
156 | 	DWORD64 EntityList = Base + OFFSETS::OFFSET_ENTITYLIST;
157 | 	DWORD64 BaseEntity = Read<DWORD64>(EntityList);
158 | 	if (!BaseEntity)
159 | 	return NULL;
160 | 	return  Read<DWORD64>(EntityList + (Ent << 5));
161 | }
162 | 
163 | string random_string(const int len) {
164 | 	const string alpha_numeric("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890");
165 | 
166 | 	default_random_engine generator{ random_device{}() };
167 | 	const uniform_int_distribution< string::size_type > distribution{ 0, alpha_numeric.size() - 1 };
168 | 
169 | 	string str(len, 0);
170 | 	for (auto& it : str) {
171 | 		it = alpha_numeric[distribution(generator)];
172 | 	}
173 | 
174 | 	return str;
175 | }
176 | 
177 | float entityNewVisTime = 0;
178 | float entityOldVisTime[100];
179 | int visCooldownTime[100];
180 | int entityHealthAndShield[100];
181 | 
182 | int main()
183 | {
184 | 	string console_title = "Apex Tool - ";
185 | 	console_title += random_string(16).c_str();
186 | 	SetConsoleTitle(console_title.c_str());
187 | 
188 | 	if (hWnd)
189 | 		cout << "[+] Found Apex Legends process..." << endl;
190 | 	else
191 | 		cout << "[+] Cant find Apex Legends process..." << endl;
192 | 
193 | 	process_id = get_process_id("r5apex.exe");				// r5apex // EasyAntiCheat_launcher
194 | 	base_address = get_module_base_address("r5apex.exe");	// r5apex // EasyAntiCheat_launcher
195 | 	cout << "[i] Process ID: " << process_id << "\n"
196 | 			<< "[i] Base Address: " << base_address << "\n"
197 | 			<< "[+] Hooking game...\n\n"
198 | 			<< "[!] Only one option can be enabled at once!" << endl;
199 | 		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_GREEN);
200 | 		cout << "	>> [NUM1] Glow based on life and shield: Enabled" << endl;
201 | 		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_RED);
202 | 		cout << "	>> [NUM2] Glow based on vision: Disabled" << endl;
203 | 		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
204 | 
205 | 	while (true)
206 | 	{
207 | 		if (GetAsyncKeyState(VK_NUMPAD1))
208 | 		{
209 | 			if (!APEXTool::Controls::colors_based_on_life_and_shield)
210 | 			{
211 | 				APEXTool::Controls::colors_based_on_life_and_shield = true;
212 | 				APEXTool::Controls::colors_based_on_vision = false;
213 | 
214 | 				system("CLS");
215 | 				cout << "[i] Process ID: " << process_id << "\n"
216 | 					<< "[i] Base Address: " << base_address << "\n"
217 | 					<< "[+] Hooking game...\n\n"
218 | 					<< "[!] Only one option can be enabled at once!" << endl;
219 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_GREEN);
220 | 				cout << "	>> [NUM1] Glow based on life and shield: Enabled" << endl;
221 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_RED);
222 | 				cout << "	>> [NUM2] Glow based on vision: Disabled" << endl;
223 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
224 | 			}
225 | 		}
226 | 
227 | 		if (GetAsyncKeyState(VK_NUMPAD2))
228 | 		{
229 | 			if (!APEXTool::Controls::colors_based_on_vision) 
230 | 			{
231 | 				APEXTool::Controls::colors_based_on_life_and_shield = false;
232 | 				APEXTool::Controls::colors_based_on_vision = true;
233 | 
234 | 				system("CLS");
235 | 				cout << "[i] Process ID: " << process_id << "\n"
236 | 					<< "[i] Base Address: " << base_address << "\n"
237 | 					<< "[+] Hooking game...\n\n"
238 | 					<< "[!] Only one option can be enabled at once!" << endl;
239 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_RED);
240 | 				cout << "	>> [NUM1] Glow based on life and shield: Disabled" << endl;
241 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_GREEN);
242 | 				cout << "	>> [NUM2] Glow based on vision: Enabled" << endl;
243 | 				SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
244 | 			}
245 | 		}
246 | 		// local player
247 | 		uintptr_t locPlayer = Read<uintptr_t>(base_address + OFFSETS::OFFSET_LOCAL_ENT);
248 | 
249 | 		for (int i = 0; i < 100; i++)
250 | 		{
251 | 			DWORD64 Entity = GetEntityByID(i, base_address);
252 | 			if (Entity == 0)
253 | 				continue;
254 | 
255 | 			DWORD64 EntityHandle = Read<DWORD64>(Entity + 0x589);
256 | 			string Identifier = Read<string>(EntityHandle);
257 | 			LPCSTR IdentifierC = Identifier.c_str();
258 | 
259 | 			if (strcmp(IdentifierC, "player"))
260 | 			{
261 | 				int playerTeamID = Read<int>(locPlayer + OFFSETS::OFFSET_TEAM);					// player team id
262 | 				int entityTeamID = Read<int>(Entity + OFFSETS::OFFSET_TEAM);					// entity team id
263 | 
264 | 				int entityHealth = Read<int>(Entity + OFFSETS::OFFSET_HEALTH);					// entity health
265 | 				int entityShield = Read<int>(Entity + OFFSETS::OFFSET_SHEILD);					// entity shield
266 | 
267 | 				int entityHnS = (entityHealth + entityShield)/2;
268 | 
269 | 				entityNewVisTime = Read<float>(Entity + OFFSETS::OFFSET_VISIBLE_TIME);
270 | 
271 | 				write<int>(Entity + OFFSETS::GLOW_CONTEXT, 1);
272 | 				write<int>(Entity + OFFSETS::GLOW_VISIBLE_TYPE, 2);
273 | 				write<GlowMode>(Entity + OFFSETS::GLOW_TYPE, { 101, 101, 100, 100 }); // GeneralGlowMode, BorderGlowMode, BorderSize, TransparentLevel;
274 | 
275 | 				static float r = 0, g = 0, b = 0;
276 | 
277 | 				if (APEXTool::Controls::colors_based_on_life_and_shield) // life'n'shield
278 | 				{
279 | 					if (playerTeamID != entityTeamID) // enemies
280 | 					{
281 | 						entityHealthAndShield[i] = entityHnS;
282 | 						int red = (int)min(2 * (100 - entityHealthAndShield[i]), 100.f);
283 | 						int green = (int)min(2 * entityHealthAndShield[i], 100.f);
284 | 
285 | 						r = red / 100.0f;
286 | 						g = green / 100.0f;
287 | 						b = 10;
288 | 					}
289 | 					else // allies
290 | 					{
291 | 						entityHealthAndShield[i] = entityHnS;
292 | 						int red = (int)min(2 * (100 - entityHealthAndShield[i]), 100.f);
293 | 						int green = (int)min(2 * entityHealthAndShield[i], 100.f);
294 | 
295 | 						r = red / 100.0f;
296 | 						g = green / 100.0f;
297 | 						b = 30;
298 | 					}
299 | 				}
300 | 				else // vision
301 | 				{
302 | 					if (entityNewVisTime != entityOldVisTime[i]) // VISIBLE enemies
303 | 					{
304 | 						visCooldownTime[i] = 32; // low values = less latency
305 | 
306 | 						r = 61.f;
307 | 						g = 2.f;
308 | 						b = 2.f;
309 | 
310 | 						entityOldVisTime[i] = entityNewVisTime;
311 | 					}
312 | 					else
313 | 					{
314 | 						if (visCooldownTime[i] <= 0) // NON-VISIBLE enemies
315 | 						{
316 | 							r = 2.f;
317 | 							g = 2.f;
318 | 							b = 61.f;
319 | 						}
320 | 					}
321 | 				}
322 | 
323 | 				write<float>(Entity + OFFSETS::GLOW_COLOR, r);
324 | 				write<float>(Entity + 0x1D4, g);
325 | 				write<float>(Entity + 0x1D8, b);
326 | 
327 | 				if (visCooldownTime[i] >= 0) visCooldownTime[i] -= 1;
328 | 			}
329 | 		}
330 | 	}
331 | }


--------------------------------------------------------------------------------